diff --git a/core/lib/Drupal/Core/DrupalKernel.php b/core/lib/Drupal/Core/DrupalKernel.php index 26068b8..7ab72da 100644 --- a/core/lib/Drupal/Core/DrupalKernel.php +++ b/core/lib/Drupal/Core/DrupalKernel.php @@ -434,6 +434,7 @@ protected function preHandle(Request $request) { */ public function handlePageCache(Request $request) { $this->boot(); + $this->initializeCookieGlobals($request); // Check for a cache mode force from settings.php. if (Settings::get('page_cache_without_database')) { @@ -886,16 +887,18 @@ protected function initializeCookieGlobals(Request $request) { if (static::$isRequestInitialized) { return; } - global $base_url, $cookie_domain; + global $cookie_domain; if ($cookie_domain) { // If the user specifies the cookie domain, also use it for session name. $session_name = $cookie_domain; } else { - // Otherwise use $base_url as session name, without the protocol - // to use the same session identifiers across HTTP and HTTPS. - list(, $session_name) = explode('://', $base_url, 2); + // Build an unique session name based on host and any site directory. We + // avoid including the protocol to use the same session identifiers across + // HTTP and HTTPS. + $session_name = $request->getHost() . $request->getBaseUrl(); + // HTTP_HOST can be modified by a visitor, but has been sanitized already // in DrupalKernel::bootEnvironment(). if ($cookie_domain = $request->server->get('HTTP_HOST')) {